Key with a value of null can result in an application compromise.

You should never use a null encryption key, since it significantly reduces the protection afforded by a good encryption algorithm, but also makes fixing the problem difficult. Information that it uses a null key encryption is accessible to at least every developer of the application. After the application is installed, the null encryption key can not be removed without updating the software. If an account that is protected by a null encryption key is compromised, system administrators will be forced either to neglect the safety, or to restrict the access to the application. Constant strings are easily extracted from the compiled application by decompilers. Therefore, it is not necessary for an attacker to have access to the source code, to determine that a null encryption key is used.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

VB.NET : Empty encryption key

DerScanner Severity Score

Do you want to fix VB.NET : Empty encryption key in your application?

See also